pyrox.dev
1{ config, lib, pkgs, ...}:
2
3with lib;
4
5let
6 cfg = config.services.varnish;
7
8 commandLine = "-f ${pkgs.writeText "default.vcl" cfg.config}" +
9 optionalString (cfg.extraModules != []) " -p vmod_path='${makeSearchPathOutput "lib" "lib/varnish/vmods" ([cfg.package] ++ cfg.extraModules)}' -r vmod_path";
10in
11{
12 options = {
13 services.varnish = {
14 enable = mkEnableOption "Varnish Server";
15
16 package = mkOption {
17 type = types.package;
18 default = pkgs.varnish5;
19 defaultText = "pkgs.varnish5";
20 description = ''
21 The package to use
22 '';
23 };
24
25 http_address = mkOption {
26 type = types.str;
27 default = "*:6081";
28 description = "
29 HTTP listen address and port.
30 ";
31 };
32
33 config = mkOption {
34 type = types.lines;
35 description = "
36 Verbatim default.vcl configuration.
37 ";
38 };
39
40 stateDir = mkOption {
41 type = types.path;
42 default = "/var/spool/varnish/${config.networking.hostName}";
43 description = "
44 Directory holding all state for Varnish to run.
45 ";
46 };
47
48 extraModules = mkOption {
49 type = types.listOf types.package;
50 default = [];
51 example = literalExample "[ pkgs.varnish5Packages.geoip ]";
52 description = "
53 Varnish modules (except 'std').
54 ";
55 };
56
57 extraCommandLine = mkOption {
58 type = types.str;
59 default = "";
60 example = "-s malloc,256M";
61 description = "
62 Command line switches for varnishd (run 'varnishd -?' to get list of options)
63 ";
64 };
65 };
66
67 };
68
69 config = mkIf cfg.enable {
70
71 systemd.services.varnish = {
72 description = "Varnish";
73 wantedBy = [ "multi-user.target" ];
74 after = [ "network.target" ];
75 preStart = ''
76 mkdir -p ${cfg.stateDir}
77 chown -R varnish:varnish ${cfg.stateDir}
78 '';
79 postStop = ''
80 rm -rf ${cfg.stateDir}
81 '';
82 serviceConfig = {
83 Type = "simple";
84 PermissionsStartOnly = true;
85 ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
86 Restart = "always";
87 RestartSec = "5s";
88 User = "varnish";
89 Group = "varnish";
90 AmbientCapabilities = "cap_net_bind_service";
91 NoNewPrivileges = true;
92 LimitNOFILE = 131072;
93 };
94 };
95
96 environment.systemPackages = [ cfg.package ];
97
98 # check .vcl syntax at compile time (e.g. before nixops deployment)
99 system.extraDependencies = [
100 (pkgs.stdenv.mkDerivation {
101 name = "check-varnish-syntax";
102 buildCommand = "${cfg.package}/sbin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)";
103 })
104 ];
105
106 users.users.varnish = {
107 group = "varnish";
108 uid = config.ids.uids.varnish;
109 };
110
111 users.groups.varnish.gid = config.ids.uids.varnish;
112 };
113}